MLPS 3.0 Discussion Draft Released: A Preparation Checklist for SMEs

In the second half of 2024, a discussion draft of MLPS 3.0 (the formal national standard version of China’s Multi-Level Protection Scheme 2.0) began circulating within a small circle of the industry. Although the formal version has not yet been finalized, the signals from regulators are clear enough: the weighting of data security has risen substantially, cloud computing and industrial control systems have been brought into the scope of mandatory assessment, and the granularity of MLPS assessment has been refined from the “system level” down to the “business function level.” Beijing market regulators recently conducted spot checks on 46 technology and trade enterprises, and more than 60% of them were required to rectify issues in the previous round of MLPS re-assessment because of insufficient log retention or missing boundary protection. That figure is somewhat higher than what I actually encountered last year.

MLPS 3.0 vs 2.0: Five Key Differences That Decide Whether You Need to Start Over

Under the MLPS 2.0 framework, the core actions for most SMEs were to add firewalls, log auditing, and penetration test reports. The logic of version 3.0 has changed — it no longer only asks whether you have something, but presses you on whether you can actually keep it under control. The first difference lies in data lifecycle management. 2.0 required data backup and access control; 3.0 adds data classification and grading. Enterprises must build their own data asset inventory and mark sensitivity levels. This inventory is not an internal control document for the assessment agency to review, but formal material to be submitted to the regulatory platform.

The second difference is the cloud computing environment. Previously, traditional enterprises with their own data centers only needed to manage their physical boundaries. Now, as long as a business system runs on a public cloud or hybrid cloud architecture, the cloud platform’s MLPS credentials, tenant data isolation scheme, and API security must all be brought into the enterprise’s own MLPS assessment scope. The third difference is industrial control systems. MLPS 3.0 upgrades industrial control security from an appendix to an independent assessment object: the network architecture, communication protocols, and operation logs of SCADA, PLC, and DCS systems must all be evaluated separately. The fourth difference is supply chain security. The security capabilities of the third-party software, open-source components, and outsourcing service providers an enterprise uses are brought into the scoring system — if your ERP vendor suffered a data breach last year, your MLPS score will be directly deducted. The fifth difference is emergency response. The emergency plans required under 2.0 are refined in 3.0 into three dimensions: the frequency of dedicated drills, the traceability of drill records, and incident post-mortem reports.

New Mandatory Requirements: Fail Any One of These Three and the Assessment Is an Automatic Fail

The MLPS 3.0 discussion draft adds three mandatory clauses, and failing to meet any one of them means the grading cannot be passed. Take a food processing enterprise in Shunyi, Beijing, that I worked with: they had just completed MLPS Level 2 last year, but once 3.0 takes effect, at least two aspects of their current management model will need to be rebuilt.

The first is that the log retention period is extended from 6 months to more than one year, and log content must include user behavior analysis and abnormal operation identification. This means enterprises must not only store logs but also have log analysis capabilities — not something a simple syslog server can handle. The second is enhanced identity authentication. 3.0 requires core business systems to enable multi-factor authentication; the combination of a password plus an SMS verification code is no longer accepted, and a strong authentication scheme based on hardware tokens or biometrics must be used. The third is the security assessment for cross-border data and the outbound transfer of important data — if your business involves transmitting user information to overseas servers, even if it is only log files, you must complete a data outbound security assessment filing. This clause previously applied only to large internet platforms; now its coverage has expanded to enterprises with annual revenue of more than RMB 50 million.

1. Log retention ≥1 year, including behavior analysis and anomaly identification
2. Mandatory multi-factor authentication for core business systems (SMS verification codes excluded)
3. Outbound transfer of important data requires a completed security assessment filing

The three items above are the least controversial clauses in the 3.0 discussion draft and are expected to be implemented directly once the formal version takes effect. What enterprises need to do now is review their existing system architecture as soon as possible and determine which business modules count as “core business” and which data may fall under the definition of “important data.” If these two steps are delayed until the assessment agency arrives on site, the time and cost will at least double.

Preparation Timeline and Consulting Costs: How SMEs Can Achieve Compliance Within Six Months

In the MLPS 2.0 era, the industry average cycle from kickoff to receiving the report was 3 to 4 months. The preparation cycle for MLPS 3.0 is expected to extend to 5 to 8 months, because the newly added data classification and grading, supply chain security, and multi-factor authentication upgrades all require longer procurement and implementation cycles. I recommend that Beijing enterprises start their gap analysis now and definitely not wait until the formal document is issued to begin — assessment agencies typically have a two-to-three-month waiting list, and starting early puts the initiative in your own hands.

On cost, the market price for an MLPS Level 3 assessment (including rectification recommendations and report preparation) ranges from RMB 80,000 to 150,000, depending on system scale and business complexity. If industrial control systems or cloud architectures are involved, a dedicated assessment fee of RMB 20,000 to 50,000 is added for each such item. The rectification portion is more flexible: basic rectification (purchasing log auditing devices, improving management systems) costs about RMB 30,000 to 80,000, while in-depth rectification (multi-factor authentication upgrades, core system rebuilding) may reach RMB 150,000 or more. This is not a small sum, but for enterprises that need to bid on government projects or apply for specific qualifications, the MLPS certificate itself is an entry threshold, and the long-term returns far outweigh the one-time compliance investment.

One situation deserves special mention: some enterprises choose to comply at the minimum standard first and carry out a second round of rectification once the formal document takes effect. This strategy was barely workable in the 2.0 era, but the risk in 3.0 is that the two requirements of data classification and grading and supply chain security call for redesigning the architecture from the ground up in the business systems, and the cost of a second round of rectification is often 1.5 to 2 times that of one-time compliance. I have seen more than one enterprise that, trying to save on the upfront analysis fee, ended up tearing everything down and rebuilding during the rectification stage — and the final tally came out to extra money wasted.

For SMEs with insufficient IT team capacity, rather than forming an internal dedicated team to deal with MLPS, it is better to hand the professional work to an IT Operations Services provider with MLPS construction experience. A mature MLPS service provider can usually handle three tasks at once — assessment coordination, technical rectification, and policy documentation — while the SME only needs to cooperate by providing business system information and staff interviews, minimizing disruption to daily operations. If your enterprise is still using the combination of a traditional firewall plus a bastion host, I recommend prioritizing an assessment of whether this architecture can meet the traffic monitoring and abnormal behavior identification requirements of 3.0 — this is where gaps are most likely to appear.